Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 230

The DOI matches its Crossref record; 10 of the 10 references it cites were found in a registry or an index.

When Do IT Security Investments Matter? Accounting for the Influence of Institutional Factors in the Context of Healthcare Data Breaches1

Angst, Corey M., Block, Emily S., D’Arcy, John, Kelley, Ken·2017·MIS Quarterly
DOI 10.25300/misq/2017/41.3.10
Open this paper in CoChat — free account

Abstract

In this study, we argue that institutional factors determine the extent to which hospitals are symbolic or substantive adopters of information technology (IT) specific organizational practices. We then propose that symbolic and substantive adoption will moderate the effect that IT security investments have on reducing the incidence of data security breaches over time. Using data from three different sources, we create a matched panel of over 5,000 U.S. hospitals and 938 breaches over the 2005–2013 time frame. Using a growth mixture model approach to model the heterogeneity in likelihood of breach, we use a two class solution in which hospitals that (1) belong to smaller health systems, (2) are older, (3) smaller in size, (4) for-profit, (5) nonacademic, (6) faith-based, and (7) less entrepreneurial with IT are classified as symbolic adopters. We find that symbolic adoption diminishes the effectiveness of IT security investments, resulting in an increased likelihood of breach. Contrary to our theorizing, the use of more IT security is not directly responsible for reducing breaches, but instead, institutional factors create the conditions under which IT security investments can be more effective. Implications of these findings are significant for policy and practice, the most important of which may be the discovery that firms need to consider how adoption is influenced by institutional factors and how this should be balanced with technological solutions. In particular, our results support the notion that deeper integration of security into IT-related processes and routines leads to fewer breaches, with the caveat that it takes time for these benefits to be realized.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.25300/misq/2017/41.3.10

Cites

10 of 10 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 10 references

Research works printed but not linked: 101

  1. Adner, 2002, When Are Technologies Disruptive? A Demand-Based View of the Emergence of Competition, Strategic Management Journal, 23, 667, 10.1002/smj.246 · DOI · Paper page
  2. Angst, 2010, Social Contagion and Information Technology Diffusion: The Adoption of Electronic Medical Records in U.S. Hospitals, Management Science, 56, 1219, 10.1287/mnsc.1100.1183 · DOI · Paper page
  3. Angst, 2012, Dual Role of IT-Assisted Communication in Patient Care: A Validated Structure-Process-Outcome Framework, Journal of Management Information Systems, 29, 255, 10.2753/MIS0742-1222290209 · DOI
  4. Anthony, 2014, Institutionalizing HIPAA Compliance Organizations and Competing Logics in US Health Care, Journal of Health and Social Behavior, 55, 108, 10.1177/0022146513520431 · DOI
  5. Appari, 2010, Information Security and Privacy in Healthcare: Current State of Research, International Journal of Internet and Enterprise Management, 6, 279, 10.1504/IJIEM.2010.035624 · DOI · Paper page
  6. Argote, 2011, Organizational Learning: From Experience to Knowledge, Organization Science, 22, 1123, 10.1287/orsc.1100.0621 · DOI · Paper page
  7. Asparouhov, 2014, Auxiliary Variables in Mixture Modeling: Three-Step Approaches Using Mplus, Structural Equation Modeling, 21, 329, 10.1080/10705511.2014.915181 · DOI · Paper page
  8. Bazzoli, 2000, The Financial Performance of Hospitals Belonging to Health Networks and Systems, Inquiry, 37, 234
  9. Berrone, P., Gelabert, L., and Fosfuri, A. 2009. “The Impact of Symbolic and Substantive Actions on Environmental Legitimacy,” IESE Business School, Working Paper Series, WP778, University of Navarra (available at https://www.iese.edu/research/pdfs/di-0778-e.pdf). · DOI
  10. Bhargava, 2014, Electronic Medical Records and Physician Productivity: Evidence from Panel Data Analysis, Management Science, 60, 2543, 10.1287/mnsc.2014.1934 · DOI
  11. Boxenbaum, 2008, Isomorphism, Diffusion, and Decoupling, 299, 10.4135/9781849200387.n3 · DOI · Paper page
  12. Brickson, 2005, Organizational Identity Orientation: Forging a Link Between Organizational Identity and Organizations’ Relations with Stakeholders, Administrative Science Quarterly, 50, 576, 10.2189/asqu.50.4.576 · DOI · Paper page
  13. Brickson, 2007, Organizational Identity Orientation: The Genesis of the Role of the Firm and Distinct Forms of Social Value, Academy of Management Review, 32, 864, 10.5465/amr.2007.25275679 · DOI · Paper page
  14. Bromley, 2012, From Smoke and Mirrors to Walking the Talk: Decoupling in the Contemporary World, Academy of Management Annals, 6, 482, 10.5465/19416520.2012.684462 · DOI · Paper page
  15. Brynjolfsson, 2000, Beyond Computation: Information Technology, Organizational Transformation and Business Performance, The Journal of Economic Perspectives, 14, 23, 10.1257/jep.14.4.23 · DOI · Paper page
  16. Bulgurcu, 2010, Information Security Policy Compliance: An Empirical Study of Rationality-Based Beliefs and Information Security Awareness, MIS Quarterly, 34, 523, 10.2307/25750690 · DOI · Paper page
  17. Burd, 2005, Information Security in Academic Institutions: Emerging Issues and Remediation Strategies, Journal of Security Education, 1, 55, 10.1300/J460v01n02_05 · doi:10.1300/j460v01n02_05
  18. Burgess, 1996, Hospital Ownership and Technical Inefficiency, Management Science, 42, 110, 10.1287/mnsc.42.1.110 · doi:10.1287/mnsc.42.1.110
  19. Campbell, 2007, Why Would Corporations Behave in Socially Responsible Ways? An Institutional Theory of Corporate Social Responsibility, Academy of Management Review, 32, 946, 10.5465/amr.2007.25275684 · DOI · Paper page
  20. Caronna, 2004, The Misalignment of Institutional ‘Pillars’: Consequences for the U.S. Health Care Field, Journal of Health and Social Behavior, 45, 45
  21. Cavusoglu, 2005, The Value of Intrusion Detection Systems in Information Technology Security Architecture, Information Systems Research, 16, 28, 10.1287/isre.1050.0041 · DOI · Paper page
  22. D’Arcy, 2011, A Review and Analysis of Deterrence Theory in the IS Security Literature: Making Sense of the Disparate Findings, European Journal of Information Systems, 20, 643, 10.1057/ejis.2011.23 · DOI · Paper page
  23. D’Arcy, 2009, User Awareness of Security Countermeasures and its Impact on Information Systems Misuse: A Deterrence Approach, Information Systems Research, 20, 79, 10.1287/isre.1070.0160 · DOI · Paper page
  24. Delmas, 2010, Voluntary Agreements to Improve Environmental Quality: Symbolic and Substantive Cooperation, Strategic Management Journal, 31, 575, 10.1002/smj.826 · DOI · Paper page
  25. Devaraj, 2003, Performance Impacts of Information Technology: Is Actual Usage the Missing Link?, Management Science, 49, 273, 10.1287/mnsc.49.3.273.12736 · DOI · Paper page
  26. DiMaggio, 1983, The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in Organizational fields, American Sociological Review, 48, 147, 10.2307/2095101 · DOI · Paper page
  27. Santos, 1995, Rewards to Investors in Innovative Information Technology Applications: First Movers and Early Followers in ATMs, Organization Science, 6, 241, 10.1287/orsc.6.3.241 · DOI · Paper page
  28. Dranove, 2014, The Trillion Dollar Conundrum: Complementarities and Health Information Technology, American Economic Journal: Economic Policy, 6, 239
  29. Duliba, 2001, Appropriating Value from Computerized Reservation Systems Ownership in the Airline Industry, Organization Science, 12, 702, 10.1287/orsc.12.6.702.10087 · DOI
  30. Edmondson, 2001, Disrupted Routines: Team Learning and New Technology Implementation in Hospitals, Administrative Science Quarterly, 46, 685, 10.2307/3094828 · DOI · Paper page
  31. Fombrun, 1990, What’s in a Name? Reputation Building and Corporate Strategy, Academy of Management Journal, 33, 233, 10.2307/256324 · DOI · Paper page
  32. Frank, 1984, Academic Abilities of Person Entering and Remaining in Special Education, Exceptional Children, 51, 76, 10.1177/001440298405100112 · DOI
  33. Gemalto . 2015. “2015 First Half Review: Findings from the Breach Level Index,” Gemalto NV, (available at https://www.gemalto.com/brochures-site/download-site/Documents/Gemalto_H1_2015_BLI_Report.pdf).
  34. Goldstein, 2005, Linking Publicness to Operations Management Practices: A Study of Quality Management Practices in Hospitals, Journal of Operations Management, 23, 209, 10.1016/j.jom.2004.07.007 · DOI
  35. Greenwood, 2011, Institutional Complexity and Organizational Responses, The Academy of Management Annals, 5, 317, 10.5465/19416520.2011.590299 · DOI · Paper page
  36. Hagland, 2009, Faith-Based Health Systems Point the Way: Mission-Driven Quality of Care Combined with Cost-Effectiveness Offer New Model for Hard Economic Times, Health Progress, 91, 16
  37. Herath, 2009, Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations, European Journal of Information Systems, 18, 106, 10.1057/ejis.2009.6 · DOI · Paper page
  38. HIPAABreach, 2014, HIPAA Breach Notification Tool
  39. HIPAAPrivacy, 2004, Summary of the HIPAA Privacy Rule
  40. Huang, 2013, Overcoming Organizational Inertia to Strengthen Business Model Innovation: An Open Innovation Perspective, Journal of Organizational Change Management, 26, 977, 10.1108/JOCM-04-2012-0047 · DOI · Paper page
  41. Johnson, 2011, Usability Failures and Data Hemorrhages?, IEEE Security & Privacy, 9, 18, 10.1109/MSP.2010.196 · doi:10.1109/msp.2010.196
  42. Johnson, 2007, What Is Organizational Imprinting? Cultural Entrepreneurship in the Founding of the Paris Opera, American Journal of Sociology, 113, 97, 10.1086/517899 · DOI · Paper page
  43. Jung, 2008, An Introduction to Latent Class Growth Analysis and Growth Mixture Modeling, Social and Personality Psychology Compass, 2, 302, 10.1111/j.1751-9004.2007.00054.x · DOI · Paper page
  44. Kankanhalli, 2003, An Integrative Study of Information Systems Security Effectiveness, International Journal of Information Management, 23, 139, 10.1016/S0268-4012(02)00105-6 · DOI · Paper page
  45. Kelley, 2008, Nonlinear Change Models in Populations with Unobserved Heterogeneity, Methodology: European Journal of Research Methods for the Behavioral and Social Sciences, 4, 97, 10.1027/1614-2241.4.3.97 · DOI
  46. Kelly, 1991, Organizational Inertia and Momentum: A Dynamic Model of Strategic Change, Academy of Management Journal, 34, 591, 10.2307/256407 · DOI · Paper page
  47. Kim, 2013, Beyond the Dichotomy of Symbolic versus Substantive Actions, 10.5465/ambpp.2013.14398abstract · DOI
  48. Kraatz, 2008, Organizational Implications of Institutional Pluralism, 243, 10.4135/9781849200387.n10 · DOI · Paper page
  49. Kraatz, 1996, Exploring the Limits of New Institutionalism: The Causes and Consequences of Illegitimate Organizational Change, American Sociological Review, 61, 812, 10.2307/2096455 · DOI · Paper page
  50. Kwon, 2013, Health-Care Security Strategies for Data Protection and Regulatory Compliance, Journal of Management Information Systems, 30, 41, 10.2753/MIS0742-1222300202 · DOI
  51. Kwon, 2014, Proactive Versus Reactive Security Investments in the Healthcare Sector, MIS Quarterly, 38, 451, 10.25300/MISQ/2014/38.2.06 · DOI · Paper page
  52. Levin, D. Z. 2006. “Institutionalism, Learning, and Patterns of Decoupling: The Case of Total Quality Management,” Working Paper, Rutgers University (available at https://www.researchgate.net/profile/Daniel_Levin4/publication/228474707_Institutionalism_learning_and_patterns_of_selective_decoupling_The_case_of_total_quality_management/links/00b7d52c8576445cb3000000.pdf).
  53. Lounsbury, 2001, Institutional Sources of Practice Variation: Staffing College and University Recycling Programs, Administrative Science Quarterly, 46, 29, 10.2307/2667124 · DOI · Paper page
  54. Lounsbury, 2001, Cultural Entrepreneurship: Stories, Legitimacy, and the Acquisition of Resources, Strategic Management Journal, 22, 545, 10.1002/smj.188 · DOI · Paper page
  55. Margolis, 2001, People and Profits? The Search for a Link between a Company’s Social and Financial Performance, 10.4324/9781410600622 · DOI · Paper page
  56. Meyer, 1977, Institutionalized Organizations: Formal Structure as Myth and Ceremony, American Journal of Sociology, 83, 440, 10.1086/226550 · DOI · Paper page
  57. Mignerat, 2009, Positioning the Institutional Perspective in Information Systems Research, Journal of Information Technology, 24, 369, 10.1057/jit.2009.13 · DOI · Paper page
  58. Mindel, 2015, Contextualist Inquiry into IT-Enabled Hospital Revenue Cycle Management: Bridging Research and Practice, Journal of the Association for Information Systems, 16, 1016, 10.17705/1jais.00415 · doi:10.17705/1jais.00415
  59. Mishra, 2012, Electronic Health Records Assimilation and Physician Identity Evolution: An Identity Theory Perspective, Information Systems Research, 23, 738, 10.1287/isre.1110.0407 · DOI
  60. Muthén, 1989, Latent Variable Modeling in Heterogeneous Populations, Psychometrika, 54, 557, 10.1007/BF02296397 · DOI · Paper page
  61. Muthén, 2004, Latent Variable Analysis: Growth Mixture Modeling and Related Techniques for Longitudinal Data, 345, 10.4135/9781412986311.n19 · DOI · Paper page
  62. Muthén, 1999, Finite Mixture Modeling with Mixture Outcomes Using the EM Algorithm, Biometrics, 55, 463, 10.1111/j.0006-341X.1999.00463.x · DOI · Paper page
  63. Muthén, 2015, Mplus User’s Guide
  64. Perez-Batres, 2012, Stakeholder Pressures as Determinants of CSR Strategic Choice: Why Do Firms Choose Symbolic Versus Substantive Self-Regulatory Codes of Conduct?, Journal of Business Ethics, 110, 157, 10.1007/s10551-012-1419-y · DOI · Paper page
  65. Pérez-Luño, 2011, The Dual Nature of Innovative Activity: How Entrepreneurial Orientation Influences Innovation Generation and Adoption, Journal of Business Venturing, 26, 555, 10.1016/j.jbusvent.2010.03.001 · DOI · Paper page
  66. Pfarrer, 2010, A Tale of Two Assets: the Effects of Firm Reputation and Celebrity on Earnings Surprises and Investors’ Reactions, Academy of Management Journal, 53, 1131, 10.5465/amj.2010.54533222 · DOI · Paper page
  67. Pisano, 2001, Organizational Differences in Rates of Learning: Evidence from the Adoption of Minimally Invasive Cardiac Surgery, Management Science, 47, 752, 10.1287/mnsc.47.6.752.9811 · DOI · Paper page
  68. Png, 2008, The Deterrent and Displacement Effects of Information Security Enforcement: International Evidence, Journal of Management Information Systems, 25, 125, 10.2753/MIS0742-1222250206 · DOI
  69. Puhakainen, 2010, Improving Employees’ Compliance Through Information Systems Security Training: An Action Research Study, MIS Quarterly, 34, 757, 10.2307/25750704 · DOI · Paper page
  70. Richardson, 2008, CSI/FBI Computer Crime and Security Survey
  71. Rodrigue, 2013, Is Environmental Governance Substantive or Symbolic? An Empirical Investigation, Journal of Business Ethics, 114, 107, 10.1007/s10551-012-1331-5 · DOI · Paper page
  72. Rogers, 1995, Diffusion of Innovations
  73. Scott, 2001, Institutions and Organizations
  74. Scott, 2008, Institutions and Organizations: Ideas and Interests
  75. Scott, 1983, The Organization of Societal Sectors, 129
  76. Scott, 2000, Institutional Change and Healthcare Organizations: From Professional Dominance to Managed Care
  77. Selznick, 1996, Institutionalism ‘Old’ and ‘New, Administrative Science Quarterly, 41, 270, 10.2307/2393719 · DOI · Paper page
  78. Sen, 2015, Estimating the Contextual Risk of Data Breach: An Empirical Approach, Journal of Management Information Systems, 32, 314, 10.1080/07421222.2015.1063315 · DOI · Paper page
  79. Seo, 2002, Institutional Contradictions, Praxis, and Institutional Change: A Dialectical Perspective, Academy of Management Review, 27, 222, 10.2307/4134353 · DOI · Paper page
  80. Shane, 2000, The Promise of Entrepreneurship as a Field of Research, Academy of Management Review, 25, 217
  81. Sloan, 1983, Investor-Owned and Not-for-Profit Hospitals: Addressing Some Issues, Health Affairs, 2, 25, 10.1377/hlthaff.2.1.25 · doi:10.1377/hlthaff.2.1.25
  82. Spetz, 2004, Measuring Levels of Technology in Hospitals, Quarterly Review of Economics and Finance, 44, 430, 10.1016/j.qref.2004.05.006 · DOI
  83. Sterba, 2013, Understanding Linkages Among Mixture Models, Multivariate Behavioral Research, 48, 775, 10.1080/00273171.2013.827564 · DOI
  84. Stevens, 2005, Symbolic or Substantive Document? The Influence of Ethics Codes on Financial Executives’ Decisions, Strategic Management Journal, 26, 181, 10.1002/smj.440 · DOI · Paper page
  85. Stiglitz, 2000, The Contributions of the Economics of Information to Twentieth Century Economics, Quarterly Journal of Economics, 115, 1441, 10.1162/003355300555015 · DOI · Paper page
  86. Stinchcombe, 1965, Organizations and Social Structure, 153
  87. Straub, 1990, Effective IS Security: An Empirical Study, Information Systems Research, 1, 255, 10.1287/isre.1.3.255 · DOI · Paper page
  88. Straub, 1998, Coping with Systems Risk: Security Planning Models for Management Decision-Making, MIS Quarterly, 22, 441, 10.2307/249551 · DOI · Paper page
  89. Sydow, 2009, Organizational Path Dependence: Opening the Black Box, Academy of Management Review, 34, 689
  90. Thompson, 2003, Organizations in Action: Social Science Bases of Administrative Theory
  91. Thornton, 2004, Markets from Culture: Institutional Logics and Organizational Decisions in Higher Education Publishing, 10.1515/9781503619098 · DOI · Paper page
  92. Tofighi, 2008, Identifying the Correct Number of Classes in Growth Mixture Models, 317
  93. Tolbert, 1983, Institutional Sources of Change in the Formal Structure of Organizations: The Diffusion of Civil Service Reform, 1880-1935, Administrative Science Quarterly, 28, 22, 10.2307/2392383 · DOI · Paper page
  94. Tuma, 1984, Social Dynamics: Models and Methods
  95. Vermunt, 2010, Latent Class Modeling with Covariates: Two Improved Three-Step Approaches, Political Analysis, 18, 450, 10.1093/pan/mpq025 · DOI · Paper page
  96. Warkentin, 2011, The Influence of the Informal Social Learning Environment on Information Privacy Policy Compliance Efficacy and Intention, European Journal of Information Systems, 20, 267, 10.1057/ejis.2010.72 · DOI · Paper page
  97. Weigelt, 1988, Reputation and Corporate Strategy: A Review of Recent Theory and Applications, Strategic Management Journal, 9, 443, 10.1002/smj.4250090505 · DOI · Paper page
  98. Westphal, 1997, Customization or Conformity? An Institutional and Network Perspective on the Content and Consequences of TQM Adoption, Administrative Science Quarterly, 42, 366, 10.2307/2393924 · DOI · Paper page
  99. Westphal, 1998, The Symbolic Management of Stockholders: Corporate Governance Reforms and Shareholder Reactions, Administrative Science Quarterly, 43, 127, 10.2307/2393593 · DOI · Paper page
  100. Westphal, 2001, Decoupling Policy from Practice: The Case of Stock Pepurchase Programs, Administrative Science Quarterly, 46, 202, 10.2307/2667086 · DOI · Paper page
  101. Willison, 2013, Beyond Deterrence: An Expanded View of Employee Computer abuse, MIS Quarterly, 37, 1, 10.25300/MISQ/2013/37.1.01 · DOI · Paper page

Cited by

See all 230

Metadata

Authors
Angst, C. M., Block, E. S., D’Arcy, J., & Kelley, K.
Venue
MIS Quarterly
Publisher
MIS Quarterly
Published
2017-09-01
Volume
41
Issue
3
Pages
893-916
ISSN
  • 0276-7783 (ISSN-L)
  • 2162-9730
DOI
10.25300/misq/2017/41.3.10
OpenAlex
W2748388916
Cited by
230
References
10
FWCI
32.09
Type
journal article
Language
en
Open access
closed

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: When Do IT Security Investments Matter? Accounting for the Influence of Institutional Factors in the Context of Healthcare Data Breaches1. https://app.cochat.ai/papers/10.25300/misq/2017/41.3.10
The paper
Angst, C. M., Block, E. S., D’Arcy, J., & Kelley, K. (2017). When Do IT Security Investments Matter? Accounting for the Influence of Institutional Factors in the Context of Healthcare Data Breaches1. MIS Quarterly. https://doi.org/10.25300/misq/2017/41.3.10

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.